topic Re: What kind of problems will I run into if I use Mac OS X server Open Directory? in General Topics

What kind of problems will I run into if I use Mac OS X server Open Directory?

bigtone — Wed, 11 Jul 2012 16:06:12 GMT

I have PAN-OS 4.1 and am wondering if I will run into any problems trying to implement user-id, authentication, etc with OS X Open Directory?

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

goku123 — Tue, 07 Aug 2012 18:51:53 GMT

User Identification in PAN-OS comprises of two pieces:

1. User-Group mapping.

2. User-ip mapping

While you may be able to achieve #1 using LDAP to pull group mapping on the PAN device, the userID agent (used for getting user-ip mapping #2) itself does not work with Mac OS X Server to pull user-ip mappings.

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

bigtone — Tue, 14 Aug 2012 15:58:09 GMT

Is there any work being done to support user-id and OS X open directory in the future?

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

goku123 — Fri, 17 Aug 2012 17:43:57 GMT

Please get in touch with your regional Palo Alto Networks SE to get more information related to new features and future PAN-OS releases. They can also file a feature request on your behalf if there isnt already one.

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

CafNetMatt — Mon, 11 Aug 2014 23:34:35 GMT

I have a client in the same dilemma. They are all Mac using Apple Servers running Open Directory to handle user authentication and profiles.

What I've found is that the Open Directory server does not log user login / logout information so there is nothing in syslog on the Open Directory server to support User to IP Mapping. This is a change that Apple implemented, I think, in 10.8 Server. So the user login is only recorded on the local computer. I also haven't found a way to enable user login logging on the Open Directory server.

My client is considering using Open Directory for handling user profiles and using Active Directory to handle user authentication just to be able to get user to IP mapping info.